pyhanko-certvalidator
Validates X.509 certificates and paths; forked from wbond/certvalidator
Decision gist · record as of 2026-08-14
Yes. The package is actively maintained, has no known vulnerabilities, supports current Python versions, and provides comprehensive X.509 validation with low install friction. Suitable for production use in PKI-aware applications. Note that the synchronous API is deprecated in favor of async equivalents, so new code should plan for async patterns.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.10 or higher.
- Most high-level APIs are now async-first; synchronous wrappers exist but are deprecated.
- Low friction install with five stable runtime dependencies.
License · maintenance · safety
MIT (permissive) — MIT license permits commercial and private use with minimal restrictions; suitable for most projects.
last release 2026-07-25 (20 days) · last repo commit 2026-08-14 · 754 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 6,294,287 downloads/mo, #1,937 on PyPI
Alternatives
Verify before relying
pip install pyhanko-certvalidator
from pyhanko_certvalidator import CertificateValidator
validator = CertificateValidator()
# Use validator.validate_usage() or async equivalents for certificate validation- Whether the synchronous API wrappers are stable enough for production use despite deprecation status
- Performance comparison between requests-based (default) and aiohttp-based OCSP/CRL clients
- Completeness of documentation for migration from synchronous to async patterns
What it is and what it does
pyhanko-certvalidator is a Python library for validating X.509 certificate chains, originally forked from wbond/certvalidator but significantly evolved for use in pyHanko. It performs comprehensive path validation including signature verification (RSA, DSA, ECDSA, EdDSA), name chaining, validity date checks, and extension processing. The library supports revocation verification through both CRL (including indirect and delta CRLs) and OCSP (including delegated responders), with configurable failure modes and response caching. It can validate certificates at a specific point in time, enforce name constraints, and handle attribute certificates.
The library has been refactored to use asynchronous I/O throughout, though synchronous wrappers remain available for backward compatibility. It depends on asn1crypto, cryptography, oscrypto, uritools, and requests. The default OCSP and CRL clients use requests for HTTP operations, with an optional aiohttp-based implementation available for more efficient async use. Bug reports and questions are routed through the pyHanko project rather than this repository directly.
Use it for
- Validate certificate chains in PKI-aware applications before trusting certificates for TLS or code signing
- Perform revocation checks via CRL or OCSP to ensure certificates have not been compromised or revoked
- Validate certificates as they were at a specific historical date for compliance or forensic purposes
- Enforce certificate policy constraints and name constraints in security-critical workflows
- Build certificate path validation into document signing or verification tools (e.g., PDF signing)
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
The package is actively maintained, has no known vulnerabilities, supports current Python versions, and provides comprehensive X.509 validation with low install friction. Suitable for production use in PKI-aware applications. Note that the synchronous API is deprecated in favor of async equivalents, so new code should plan for async patterns.
Install
pyhanko-certvalidator on PyPI
Before you install
Low friction install with five stable runtime dependencies. Actively maintained with a release within the past month and recent commits. Supports current Python versions (3.10+).
Requires Python 3.10 or higher. Most high-level APIs are now async-first; synchronous wrappers exist but are deprecated.
License in practice
MIT license permits commercial and private use with minimal restrictions; suitable for most projects.
Quickstart
pip install pyhanko-certvalidator
from pyhanko_certvalidator import CertificateValidator
validator = CertificateValidator()
# Use validator.validate_usage() or async equivalents for certificate validationVerify before relying
- Whether the synchronous API wrappers are stable enough for production use despite deprecation status
- Performance comparison between requests-based (default) and aiohttp-based OCSP/CRL clients
- Completeness of documentation for migration from synchronous to async patterns
Package facts
| License | MIT permissive |
| Python support | Supports the current Python release >=3.10 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 5 packagesasn1cryptooscryptocryptographyuritoolsrequests |
| Maintenance | Actively maintained 20 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 6,294,287 / month, #1,937 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 4 - BetaIntended Audience :: DevelopersProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Topic :: Security :: Cryptography |
Evidence: pyhanko_certvalidator-0.31.4-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “certificate path validation”
- pyhanko-certvalidatorValidates X.509 certificate paths with support for revocation checks…
- certvalidatorValidates X.509 certificates and certificate chains, supporting path…
- certifiCertifi provides Mozilla's curated collection of root SSL…
Give your agent the search over MCP, or paste the wish link into any chat.
More Cryptography packages
Certifi provides Mozilla's curated collection of root SSL certificates for Python applications to validate TLS hosts and verify certificate trustworthiness.
cryptography provides cryptographic recipes and low-level primitives for symmetric encryption, message digests, key derivation, and other common cryptographic algorithms in Python.
Pure-Python RSA encryption, decryption, signing, and key generation following PKCS#1 v1.5, with command-line and library interfaces.
pyOpenSSL wraps OpenSSL's SSL/TLS functionality for Python, providing high-level connection objects and certificate handling through a Python-friendly interface around OpenSSL's cryptographic operations.
Provides Microsoft Entra ID token-based authentication for Azure SDK clients through a set of TokenCredential implementations that handle OAuth flows and managed identity support.
PyNaCl provides Python bindings to libsodium for digital signatures, secret-key and public-key encryption, hashing, message authentication, and password-based key derivation.
See also certvalidator · ocspbuilder · ocspresponder · aia · openssl-ocsp-responder · wincertstore · truststore · pyHanko · service-identity · asn1crypto